docs: bring every doc current for release

[chriskehayias]

Summary

Release-readiness audit of CLAUDE.md, README.md and all 14 linked reference documents. Every factual claim was verified against the code, the tests and git history — not against the prose already there. Six agents worked concurrently, each owning a disjoint set of files.

Docs only. No source changes.

What was actually wrong

Most of these were not "slightly out of date" — they were claims that would mislead someone acting on them.

Doc	Problem
README.md	Documented /branch-commit and /pr skills that don't exist. Real ones are /audit-deps and /release.
README.md	"3 moderate postcss advisories" — npm audit now reports 0 vulnerabilities across 720 packages.
README.md	"~190+ test cases across 6 test files" — actually 1,015 tests across 59 files.
README.md	getFilesByRecord({ tableName }) — the real key is table; as written it queries undefined.
README.md / CLAUDE.md	Imported a Congregation type that does not exist (it's Congregations).
README.md	Both headline createTableRecords examples used new Date().toISOString() — the exact anti-pattern practice #11 forbids, in the snippet new contributors copy first.
auth.md	Claimed id_token nonce binding was on; f88a9f1 disabled it because MP never sends the claim. Also claimed customSession makes no API calls.
security-headers.md	Contradicted itself on which CSP relaxations are dev-only.
OAUTH_LOGOUT_SETUP.md	Largely NextAuth-era fiction — cited src/auth.ts "line 63", a file that doesn't exist.
shared-actions/README.md	Documented three modules (auth, analytics, notifications) that were never in the repo.
provider README.md	Documented hand-written model files that don't exist; omitted three real FileService methods.
scripts README.md	Generated-interface example was inverted; stored-procs generator undocumented. Its "recommended workflow" combined --clean with --search, which would wipe all 603 files.
query-syntax.md	Wrong endpoint (/tables/{table}/get vs GET /tables/{table}); cited MCP tools this repo doesn't have; ESCAPE '' silently disabled every escape.
datetimehandling.md	The datetime-local recipe was invented and did the opposite of the real implementation.

Documented for the first time

• AuthorizationService, SessionContextService, DomainTimezoneService — absent from both root docs despite the role gate being this release's most significant change.
• MP_SECURITY_ROLES and CSP_ENFORCE, including that CSP_ENFORCE is inverted on purpose so a typo fails loud (too strict) rather than silent (no policy).
• The three error boundaries from 07a2bd9.
• Coverage gating — per-glob thresholds plus the global backstop, and that Codecov is fail_ci_if_error: false, so the thresholds are the real PR gate.
• New CLAUDE.md practice Add demo showcase to homepage with Contact Lookup card #13 on filter sanitization. filter-sanitize.ts is mandatory at every interpolation site and closed a real read-widening injection, but no rule covered it.
• The three deliberate authorization carve-outs, so the rule stops reading as violated by its own exceptions.
• The App Router default-export exception to the named-exports rule.

Verified counts

301 MP tables · 603 generated model files · 19 UI components · 59 test files · 1,015 tests · 532 stored procedures · 99.74% statement coverage

Test plan

• npx tsc --noEmit — clean
• npm run lint — clean
• npm run test:coverage — 1,015 passed, 99.74% statements
• npm audit — 0 vulnerabilities
• npm run deps:verify — no lockfile drift
• All relative markdown links in both root docs resolve to real files

Follow-ups not included here (kept this branch docs-only)

Surfaced by the audit, worth a separate PR:

1. src/proxy.ts:22 — comment still says CSP "Ships as Content-Security-Policy-Report-Only until CSP_ENFORCE=true". False since 67e1329; the polarity is inverted.
2. src/components/contact-logs/contact-logs.tsx:65 — comment claims "the app has no error boundary". Untrue since 07a2bd9. The defensive code is still right; the stated reason isn't.
3. src/app/(web)/contactlookup/page.tsx:3 — deep-imports past the barrel export.
4. src/components/sign-in/sign-in.tsx — the only feature component with no co-located test, and it holds the F3 open-redirect sanitizer and the double-OAuth guard.
5. Five test files carry Regression guard for .claude/TODO/<x>.md comments naming deleted TODO files.
6. disableIdTokenNonceBinding is not asserted by any test, so removing it would fail only at a real sign-in.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!